OpenVPN is a robust, scalable and highly configurable VPN (Virtual Private
Network) daemon which can be used to securely link two or more private networks
using an encrypted tunnel over the internet. It can operate over UDP or TCP,
can use SSL or a pre-shared secret to authenticate peers, and in SSL mode, one
server can handle many clients.
===> The following configuration options are available for openvpn-2.7.8:
ASYNC_PUSH=off: Enable async-push support
DCO=on: Data Channel Offload/ovpn(4) support->README.dco.md
DOCS=on: Build and/or install documentation
EASYRSA=on: Install security/easy-rsa RSA helper package
EXAMPLES=on: Build and/or install examples
LZ4=on: LZ4 compression support
LZO=on: LZO compression (incompatible with LibreSSL)
PKCS11=on: Use security/pkcs11-helper, needs same SSL lib!
SMALL=off: Build a smaller executable with fewer features
TEST=on: Build and/or run tests
UNITTESTS=off: Enable unit tests
X509ALTUSERNAME=off: Enable --x509-username-field
===> Use 'make config' to modify these settings
Reason:
The openvpn 2.7 port update no longer installs the openvpn-client.up
and openvpn-client.down scripts into libexec/, but instead a
dns-updown script into libexec/openvpn/.
Review your configuration, and the openvpn man page for --dns-updown.
Reason:
OpenVPN has been updated to the new upstream release v2.6.0, which
is quite compatible with v2.5 versions.
A copy of the latest v2.5.8 port is being kept as security/openvpn25 (or
openvpn25 package) until end of March 2023.
* Add support for running multiple instances of openvpn to the startup script
Inspired by [1]
* Bump PORTREVISION
* Update the comment which says not to send notices about 2.0.8 to 2.0.9 since
2.0.9 also introduces only Windows changes. Remove maintainer's name from
this comment since he did not explicitly state this.
PR: ports/108371 [1]
Submitted by: Denis Shaposhnikov <dsh@vlink.ru>, Gleb Kozyrev
<gkozyrev@gmail.com> [1]
Approved by: matthias.andree@gmx.de (maintainer timeout, 28 days)
- Fix build failures that arose from an accidentally omitted -fPIC.
- Portrevision bumped since the change affects all architectures,
not just those that were failing.
PR: ports/103863
Submitted by: Matthias Andree <matthias.andree@gmx.de> (maintainer)
Reported by: pointyhat
1 - build and install lib/openvpn-down-root.so plugin (see --plugin option in
the man page) and README.openvpn-down-root
2 - match rc.d filename as printed post install in pkg-message to actual file
name on newer systems (which use openvpn rather than openvpn.sh)
Reported by: Jean-Baptiste Quenot (Bcc'd)
The maintainer wishes to thank Jean-Baptiste for his report and patience.
3 - add a pkg-req script to prevent installation of 6.1 packages on older
machines, which is a frequent source of "rc.d script doesn't work"
complaints.
Added file(s):
- files/pkg-req.in
PR: ports/100917
Submitted by: Matthias Andree (maintainer)
Add a message explaining why it won't be upgraded to 2.0.7 version, to
prevent a lot of people asking maintainer about it:
# -----------------------------------------------------
# DO NOT BOTHER TO SEND NOTICES ABOUT 2.0.7 AS IT FIXES
# A WINDOWS-ONLY BUG THAT DOESN'T AFFECT *BSD AND THUS
# DOES NOT WARRANT A PORT UPGRADE! AND UPGRADE REQUESTS
# WILL BE DROPPED. -- Matthias Andree, 2006-04-26
# -----------------------------------------------------
PR: ports/96383
Submitted by: maintainer
- Update to 2.0.6
* security fix for client LD_PRELOAD code injection vulnerability
through compromised upstream servers
(FreeBSD VuXML Vuln VID be4ccb7b-c48b-11da-ae12-0002b3b60e4c,
filed in separate PR)
CVE id not known yet
* 2 other changes only relevant for Linux and NetBSD, not detailed here.
PR: ports/95345
Submitted by: maintainer
Security: VuXML be4ccb7b-c48b-11da-ae12-0002b3b60e4c
Remove the FreeBSD KEYWORD from all rc.d scripts where it appears.
We have not checked for this KEYWORD for a long time now, so this
is a complete noop, and thus no PORTREVISION bump. Removing it at
this point is mostly for pedantic reasons, and partly to avoid
perpetuating this anachronism by copy and paste to future scripts.
FreeBSD 6 no longer adds debug.if_* sysctl variables in its default kernel
(according to the release notes), so our heuristic assumes the module is
missing and tries to load it, which fails as the module already exists.
PR: ports/86286
Submitted by: maintainer
- Update to 2.0.2 that brings these upstream changes:
- fix bug that would exhaust file descriptors as the routing table was
modified
(this had already been part of the port previously)
- fix bug that would block the management socket until the peer connected
- fix pkitool sh incompatibilities (from NetBSD)
PR: ports/85299
Submitted by: maintainer
Fix a typo in the new rc file, where documentation didn't match the
actual variables.
PR: ports/85156
Submitted by: maintainer
Reported by: Benjamin Lutz <benlutz@datacomm.ch>
Approved by: portmgr (krion)
- Security update to version 2.0.1, fixing four denial of service bugs,
CAN-2005-2531, CAN-2005-2532, CAN-2005-2533, CAN-2005-2534
- Drop old init script and add a modern rcNG script in its place,
requested by Matthias Grimm and Dirk Gouders (although the script below is
one I, Matthias Andree, wrote). It can automatically load tun/tap drivers.
- move pkg-message to files/pkg-message.in, revise it, list it in SUB_FILES
to expand ${PREFIX}.
- print pkg-message after installation from port
- switch to official "make check" as smoke-test, rather than wiring our own.
- prefer LZO2 in most situations, as OpenVPN will pick up LZO2 rather than
LZO1 if both are installed.
PR: ports/85109
Submitted by: maintainer
Approved by: portmgr (krion)
Revise pkg-message to mark more prominently that the default
port is now 1194 rather than 5000, and refer users to the
online release notes if looking for information WRT older versions.
PR: 80300
Submitted by: maintainer
